The safety of a medical device depends on work the manufacturer does not do in its own facility. ISO 13485 clause 7.4 requires suppliers to be selected, monitored and re-evaluated against criteria proportionate to their effect on the product. Under the MDR, a notified body may include your critical suppliers and contract manufacturers in its unannounced audits.
How is a critical supplier identified?
Criticality is measured by the supplier’s effect on the safety and performance of the product. Sterilisation services, contract manufacturing, implant raw material, sterile barrier packaging and software that goes into the device are typical examples. Office supplies and general services do not fall into the same category.
The criticality decision has to rest on a written criterion; a supplier treated as critical out of habit cannot be justified in an audit.
How does an audit run?
An audit is not carried out to score the supplier but to see the processes that affect your product. A typical flow: defining scope and criteria, the audit plan, the opening meeting, following processes through an example (from incoming material to shipment), classifying findings, the report, and following up the effectiveness of the corrective action.
What should a quality agreement contain?
At a minimum:
- Definition of the product or service supplied and the acceptance criteria
- The obligation to notify changes: process, material, manufacturing site
- Retention period for records and conditions of access
- Notification of nonconformities and complaints
- The right to audit — including unannounced audits by the notified body
- Conditions for the use of sub-contractors
How is performance monitored?
An audit is an event that happens once a year; monitoring is continuous. Incoming inspection results, on-time delivery rate, the number of nonconformities and complaints, and compliance with change notifications accumulate in the supplier file and feed the next evaluation. Where performance drops, audit frequency increases or a second source is brought in.
Unannounced audits reach your suppliers too
A notified body carries out unannounced audits at a certified manufacturer at least once every five years, and where appropriate those audits may also take place at the manufacturer’s suppliers and subcontractors (MDR Annex IX, section 3.4). The audit plan is not disclosed to the manufacturer. During the audit a sample of the devices produced, or a sample from the manufacturing process, is checked against the technical documentation.
The practical consequence: a critical supplier of yours may be visited without warning. Whether that supplier is ready depends on the right of audit and the duty to cooperate being written into your quality agreement. Without that clause, the possibility that the supplier refuses the audit affects your certificate directly.
Responsibility cannot be outsourced
Contract manufacturing, sterilisation services or outsourcing part of the design does not reduce the manufacturer’s responsibility. MDR Article 10 holds the manufacturer responsible for the conformity of the device; controlling work done outside is part of the quality management system.
That is why a supplier file is not a folder but a traceable chain: the justification for selection, evaluation records, the quality agreement, audit reports, follow-up of corrective actions, performance data and the re-evaluation decision. A subcontractor using its own subcontractors is made conditional in the contract too — if you do not know where the chain ends, traceability ends there as well.
Supplier-driven changes also affect the validation and biocompatibility files, which makes change notification the most critical clause in the agreement.
How is an audit finding closed?
Writing a finding is easy; closing it is hard. The decision to close rests on three questions: was the root cause genuinely found, does the action taken remove that root cause, and was the effectiveness of the action demonstrated in the next production run?
Training staff is not a corrective action on its own; training makes sense when the root cause is human error and another control has been put in place to prevent recurrence. The closure deadline and the verification method are written in the audit report. Findings left open directly affect the audit frequency and risk class assigned at the supplier’s next evaluation.
Is a remote audit enough?
A remote audit does not replace an on-site audit in every case. Document review, sampling of records and interviews can be done remotely; the flow of the production line, housekeeping, storage conditions and what people actually do cannot be seen reliably through a screen.
What works is a combination: documentation is reviewed remotely and the time spent on site goes to production and storage conditions. For critical suppliers the first audit and audits after a major change are done on site; in the years between, a remote review may be enough. Which audit uses which method is written, with its justification, in the audit programme.
If the remote audit will be recorded, that is made subject to the supplier’s consent and written into the contract. Whatever the method, the sampling plan and the processes to be examined are notified in advance; the quality of a finding depends as much on preparation as on the time spent on site.
Common problems
Applying the same evaluation form to every supplier is a common mistake. A printer producing package labels and a company providing sterilisation services going through the same control means the critical one is not audited enough. Audit frequency should follow the risk level of the supplier and past performance. Audit findings should be followed until the supplier’s corrective action is closed.
